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Abstract 

Secure communication over a memoryless wiretap channel in the presence of a passive eavesdropper 
is considered. Traditional information-theoretic security methods require an advantage for the main 
channel over the eavesdropper channel to achieve a positive secrecy rate, which in general cannot be 
guaranteed in wireless systems. Here, we exploit the non-linear conversion operation in the eavesdrop- 
per's receiver to obtain the desired advantage - even when the eavesdropper has perfect access to the 
transmitted signal at the input to their receiver. The basic idea is to employ an ephemeral cryptographic 
key to force the eavesdropper to conduct two operations, at least one of which is non-linear, in a different 
order than the desired recipient. Since non-linear operations are not necessarily commutative, the desired 
advantage can be obtained and information-theoretic secrecy achieved even if the eavesdropper is given 
the cryptographic key immediately upon transmission completion. In essence, the lack of knowledge of 
the key during the short transmission time inhibits the recording of the signal in such a way that the secret 
information can never be extracted from it. The achievable secrecy rates for different countermeasures 
that the eavesdropper might employ are evaluated. It is shown that even in the case of an eavesdropper 
with uniformly better conditions (channel and receiver quality) than the intended recipient, a positive 
secure rate can be achieved. 

Index Terms 

Wiretap channel, everlasting secrecy, provable security, random power modulation, wireless net- 
works, non-idealities of receiver. 
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I. Introduction 

Wireless networks, due to their broadcast nature, are vulnerable to being overheard, and hence 
security is a primary concern. The standard method of providing security against eavesdroppers 
is to encrypt the information so that it is beyond the eavesdropper's computational capabilities to 
decrypt the message [1]; however, the vulnerability shown by many implemented cryptographic 
schemes, the lack of a fundamental proof establishing the difficulty of the problem presented 
to the adversary, and the potential for transformative changes in computing motivate forms of 
security that are provably everlasting. In particular, when a cryptographic scheme is employed, 
the adversary can record the clean cypher and recover it later when the cryptographic algorithm 
is broken 0, which is not acceptable in sensitive applications requiring everlasting secrecy. 
The desire for such everlasting security motivates considering emerging information-theoretic 
approaches, where the eavesdropper is unable to extract from the received signal any information 
about the secret message. 

In 1946, Shannon introduced information-theoretic - or perfect - secrecy 0. If the uncertainty 
of the message after seeing the cypher is equal to the uncertainty of the message before seeing 
the cypher, we have perfect secrecy without any condition on the eavesdropper's capabilities. 
Wyner later showed that if the eavesdropper's channel is degraded with respect to the main 
channel, adding some randomness to the codebook allows perfect secrecy to be achieved [|4]|. 
Csiszar and Korner extended the idea to more general cases, where the eavesdropper's channel 
is not necessarily degraded with respect to the main channel, but it must be "more noisy" or 
"less capable" than the main channel Q. When such an advantage does not exist, one can turn 
to approaches based on "public discussion" J6l, 0, but these approaches, while they could be 
used to generate an information-theoretically secure one-time pad, are generally envisioned for 
secret key agreement to support a cryptographic approach [8, Chapter 7.4] rather than efficient 
one-way secret communication. 

Consequently, the desirable situation for achieving information theoretic secrecy is to have 
a better channel from the transmitter to the intended receiver than that from the transmitter 
to the eavesdropper. However, this is not always guaranteed, particularly in wireless systems 
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where the eavesdropper can have a large advantage over the intended receiver. In the case of a 
passive adversary, the eavesdropper can be very close to the transmitter or it can use a directional 
antenna to improve its received signal, while there is often no way for the legitimate nodes to 
know the eavesdropper's location or its channel state information. Recent authors have considered 
approaches that relax the need for assumptions on Eve's location or channel in one-way systems. 
For cases when the eavesdropper location is unknown (which means the case of a "near Eve" 
must be considered), approaches largely based on the cooperative jamming approach of [9] and 
ifTOl have been considered ifTTTl . Ifl2l . However, all of these approaches require either multiple 
antennas, helper nodes, and/or fading (for example, [fT3l . 03]|), and many are susceptible to 
attacks such as pointing directive antennas at one or both communicating parties. 

For a one-way scenario with a single antenna where Bob's channel is worse than Eve's, 
Cachin and Maurer [15J exploited the realizability of hardware to consider the case of everlasting 
security, as is our interest. In particular, they introduced the "bounded memory model" - signal 
is in such a way that the receiver cannot store the information it would need to eventually break 
the cypher. This novel approach suffers from two shortcomings: (1) by Moore's Law (see NAND 
scaling plot at lfT6lO . the density of memories increases at an exponential rate; (2) memories can 
be stacked arbitrarily subject only to (very) large space limitations. Hence, although the bounded 
memory model is a viable approach to everlasting security, it is difficult to pick a memory size 
beyond which it will be effective, making its employment for secret wireless communication 
difficult. Rather than attacking the memory in the receiver back-end, our contention is that one 
should instead consider attacking the receiver front-end and analog-to-digital (A/D) conversion 
process, where technology progresses slowly and there exist well-known techniques for severely 
handicapping the component. And, unlike memory, A/D's cannot be stacked arbitrarily, as clock 
jitter prevents the timing required; in fact, high-quality A/D's already employ parallelization 
to the limit of the jitter. And, importantly from a long-term perspective, there is a fundamental 
bound on the ability to perform A/D conversion lUTl . [fT8l . Consider the channel model shown in 
Figure [Q which reflects the understanding that in an adversarial game in modern communication 
systems, it is the interference effects on wideband receiver front-ends rather than the baseband 
processing that is the significant detriment [fT9l . In particular, the signal is subject to a variety of 
distortions due to the RF front-end of the receiver and the analog-to-digital conversion. A large 
interferer, even if it is orthogonal to the signal of interest and thus (supposedly) easily rejected 
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Fig. 1. The message X is observed at Bob and Eve through the transmitter, the AWGN channels with different noise variances, 
and their respective receivers with (possibly nonlinear) functions g(.), /(•)> an d /e(0- The sequence k is a cryptographic key 
shared by Alice and Bob, which is assumed to be obtained by Eve immediately after she has recorded Z. 

by baseband processing, can saturate the receiver front-end, leading to nonlinearities, and, of 
particular interest here, reducing the receiver's dynamic range (i.e. resolution) significantly. 

The primary focus of this paper is to exploit the receiver processing effects for security. In 
particular, based on a pre- shared key between Alice and Bob that only needs to be kept secret 
for the duration of the wireless transmission (i.e. it can be given to Eve immediately afterward), 
we consider how inserting intentional (but known to Bob) distortion on the transmitted signal 
can provide information-theoretic security. In particular, since Bob knows the distortion, he can 
undo its effect before his A/D, whereas Eve must store the signal and try to compensate for 
the distortion after her A/D. Since the A/D is necessarily non-linear, the operations are not 
necessarily commutative and there is the potential for information-theoretic security. This paper 
introduces this idea and initiates its investigation. 

As a first example, we perform a rapid power modulation between two vastly different power 
levels at the transmitter and put the reciprocal of that power gain before Bob's A/D. In particular, 
cellular (and other) networks usually have significantly more power available for users at many 
locations than their lowest data rate requires for successful transmission. For example, users near 
a base station in a cellular system have the capability to transmit significantly more power than the 
minimum required to convey a high-quality voice signal. Hence, a secure communication system 
to cover a restricted area (e.g. a company's building) built on analogous link budgets to cellular 
technology would have the capability to transmit excess power to enable secure communication, 
as follows. Suppose Alice employs an ephemeral cryptographic key known only to her and Bob to 
rapidly modulate her transmit power between the minimum required for successful transmission 
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and the maximum available from her radio. This power modulation can be done quite rapidly, 
as modern power amplifiers can easily have their power switched at high bandwidths ll20ll Ell 
Chapter 7]. Bob, since he knows the key, places a gain before his A/D that changes rapidly in 
concert with the transmitted power to ensure that the received signal is matched to the span of 
the A/D. Since the power can be changed every symbol, Eve cannot use any type of automatic 
gain control (AGC) loop and is left trying to select a gain that trades off resolution and the 
probability of overflow of her A/D. By exploiting the resulting distortion, information-theoretic 
secrecy can be obtained, even if Eve is given the key immediately after message transmission. 

The rest of paper is as follows. Section|II]describes the system model, metrics, and the proposed 
idea in detail. In Section [Till the proposed method is applied to settings with noisy channels and 
noiseless channels, respectively, to find achievable secrecy rates in each case, and an asymptotic 
analysis of the proposed method is provided. In Section [TV] the results of numerical examples 
for various realizations of the system are presented. The comparison of the proposed method to 
the public discussion approaches of 0, is provided in Section |V] Conclusions and ideas for 
future work are discussed in Section [VT] 

II. System Model and Approach 

A. System Model and Metric 

We consider a simple wiretap channel, which consists of a transmitter, Alice, a receiver, Bob, 
and an eavesdropper, Eve. Eve is a passive eavesdropper, i.e. she just tries to obtain as much 
information as possible to recover the message that Alice sends and she does not attempt to 
actively thwart (i.e. via jamming, signal insertion) the legitimate nodes. Therefore, the location 
and channel state information of Eve can be difficult to obtain and thus is assumed unknown to 
the legitimate nodes. 

We assume that Alice and Bob either pre-share a cryptographic key or that they employ a 
standard key agreement scheme (e.g. Diffie-Hellman Il22l0 to generate a shared key and then 
expand the number of key bits aggressively using a linear feedback shift register (LFSR) to 
generate a long key sequence. In general the output of an LFSR, even when the initial state 
is unknown, is easily predictable and thus inappropriate for cryptography. However, our system 
design only employs the key ephemerally; in fact, we assume (pessimistically) that Eve is handed 
the full key as soon as transmission is complete. Since Eve only views the transmitted signal 
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through a very noisy process (see below), we assume she cannot hope to recover the key during 
the (very) short transmission period. 

We consider a memoryless one-way communication system, and assume that both Bob and 
Eve are at a unit distance from the transmitter by including variations in the path-loss in the 
noise variance. Thus, the channel gain of both channels is unity and both channels experience 
additive white Gaussian noise (AWGN). Let ub and ue denote the zero-mean noise processes 
at Bob's and Eve's receivers with variances Nb and Ne, respectively. Let X denote the input of 
both channels, Y denote the received signal at Bob's receiver, and Z denote the received signal 
at Eve's receiver. The signal at Bob's receiver is: 

Y = X + n B 

and the signal at Eve's receiver is: 

Z = X + n E 

Both Bob and Eve employ high precision uniform analog-to-digital converters. The effect of 
the A/D on the received signal (quantization error) is modeled by a quantization noise due to the 
limitation in the size of each quantization level, and a clipping function due to the quantizer's 
overflow. The quantization noise in this case is (approximately) uniformly distributed ll23l . so 
we will assume it is uniformly distributed throughout the paper. For an m-bit quantizer (b = 2 m 
gray levels) over the full dynamic range [—a, a], two adjacent quantization levels are spaced by 
S = 2a /b, and thus the quantization noise is uniformly distributed over an interval of length 
5. Quantizer overflow happens when the amplitude of the received signal is greater than the 
quantizer's dynamic range, which can be modeled by a clipping function. 

Let X denote the current code symbol, which we assume is taken from a standard Gaussian 
codebook where each entry has variance P, i.e. X ~ A/"(0, P). Note that although the Gaussian 
codebook is optimal to achieve the secrecy capacity in the case of AWGN wiretap channels, 
because we consider quantization errors in our model, the Gaussian codebook is no longer 
optimum, implying that our results represent achievable rates but not upper bounds. 

From [|24|. for an arbitrary stationary memoryless wiretap channel with arbitrary input and 
output alphabets, any secrecy rate 

R s < max [/(X; Y) - I(X; Z)\ 
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is achievable. Hence, the average secrecy rate that can be achieved is: 

R S (S, S') = E [/(X; Y) - I(X; Z) \S, S'\ 

where S is the strategy taken by Alice, S' is the strategy taken by Eve, and expectation is over 
the (potential) randomness of the strategy. The eavesdropper (Eve) tries to pick a strategy that 
minimizes R s . On the other hand, the transmitter (Alice) tries to choose a strategy to maximize 
the worst case (minimum) R s . To formulate this, we use the following maxi-min criteria: 

R* = max mm R S (S,S') (1) 
s S' 

Here, R* s is the minimum secrecy rate that can be guaranteed. In other words, no matter which 
strategy S' Eve takes, choosing the appropriate strategy S will guarantee the secrecy rate R* s . 

B. General Nonlinearity: Rough Analysis 

Our goal is to consider how Alice and Bob can employ bits of the shared cryptographic 
key to modify their radios as shown in Figure Q] to gain (or maximize) an information the- 
oretic advantage. For now, assume that they insert general memoryless nonlinearities g{.) at 
the transmitter and /(.) = g~ l {-) at the receiver based on the key. Suppose that Eve is able to 
obtain the key just after the transmission is finished; considering for the moment that she applies 

to Z, one sees how the security is (potentially) obtained: Bob sees g(X) through 
and the A/D, whereas Eve sees those operations in reverse. Since nonlinear operations are not 
(necessarily) commutative, the signals are not the same and there is the potential for some form 
of information-theoretic security. 

Now, stepping back to allow Eve to use the key sequence k in whatever manner she wants 
after she has recorded the transmission yields an illustrative information-theoretic model. In 
particular, using the same random coding arguments as for fading channels, consider a collection 
Q of functions g{.) from which k selects; then, the secrecy rate is: 

R s = E g [I(X;Y\k)-I(X;Z\k)} 

Let us be pessimistic and assume a\ = 0. Furthermore, to get some insight, assume temporarily 
that o 2 B = 0, corresponding to a short-range situation which is not power-limited. For a\ = 0, 



Fig. 2. Alice and Bob share a cryptographic key that determines the value of A at each time instance. Eve puts a (possibly 
variable) gain before her A/D to decrease the A/D erasures and/or overflows and hence increase the information leakage. 



Y does not depend on k and thus using the approach for analyzing quantizers of ll2~5l pg. 251], 
which is accurate at high resolution: 

R s = Eg[I(X; Y) - I(X; Z\k)} = E g [H{Y) - H{Y\X) - (H(Z\k) - H(Z\X,k))} 
« E g [h{Y) - \og{8) - (h(Z\k) - \og(5))\ = E g [h{Y) - h(Z\k)\ 
= E g [h(X) - h(g(X))} 

where Y and Z are the inputs to Bob and Eve's A/D converters, respectively. It then becomes 
apparent that the gain observed here for high-resolution A/D's at both Bob and Eve is a shaping 
gain between X and g(X). Whereas we think of shaping gains as tending to be relatively small 
(1.53 dB on the Gaussian channel 112610 . that is because the generally considered gains are 
between the optimal (Gaussian) shaping and a standard but reasonable (uniform) shaping. In our 
design scenario, if we are able to severely distort g(X), the gains can become enormous. We 
quickly caveat this conclusion by noting that the assumption a 2 B = is critical, since those g(.) 
which are most distorting can also cause significant "noise enhancement" on the channel from 
Alice to Bob. Hence, unless the noise is truly negligible (i.e. very short range communication), 
judgment should be reserved on the applicability of the technique until o\ ^ is considered in 
Section Hill 

C. Rapid power modulation for secrecy 

For the rest of the paper, we simplify the operator g(.) to a random gain to consider a practical 
architecture easily implemented and discuss specific operating scenarios. Our goal is to achieve 
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a positive secrecy rate by confusing the eavesdropper's A/D. Throughout this paper we assume 
that Eve is able to employ just one A/D, reserving discussion of the multiple A/D case to Section 
IVll Here, the strategy that Alice takes to confuse Eve's A/D is to apply a random gain from a 
fixed probability distribution to the signal amplitude of each symbol that she transmits. Suppose 
that A denotes the random variable associated with this random gain, and the probability density 
function (pdf) of this gain is Pa(u) where u E A (see Fig. O. The pdf of A is known to all 
nodes, but only legitimate nodes know the exact sequence of values of A (i.e. ui,u 2 ,U3, ■ ■ ■) 
that has been applied to the symbol sequence. 

We want to find a probability distribution for A that maximizes this secrecy rate. We choose 
this gain such that it does not change the average power of the transmitted signal, i.e. E[| A\ 2 ] = 1. 
To control the number of key bits required, we consider that \A\ is drawn from one of two levels 
Ax and A 2 with random polarity (i.e. A = {A\, —A%, A 2 , — A 2 })\ 



Pr(A = u) 



P, u = Ai 

1 - p, u = A 2 

and Pr{A > 0} = Pr{A < 0} = l /2. Suppose that A\ is the large gain and A 2 is the small 
gain that the transmitter applies. We define the ratio between the large gain and the small gain 

Since Bob shares the (long) key with Alice, he easily "inverts" the gain A to operate his A/D 
properly, whereas Eve will struggle with such. In essence, we are inducing a fading channel at 
Bob that he is able to equalize before his A/D, whereas Eve cannot. Bob applies the reciprocal 
of A before his A/D and thus given A, the signal that Bob's A/D sees is: 

Y = X + (2) 
A 

To cancel the effect of this gain, Eve also applies an arbitrary (possibly random) gain, 1/G. So, 
the signal at Eve's A/D given A and G is: 

Suppose that Eve knows the pdf of A; hence, she tries to find a probability density function 
Pa(g) for G such that it minimizes the secrecy rate R s or equivalently maximizes the information 
leakage I(X; Z). On the other hand, Alice sets the pdf parameters to maximize R s . So, Alice 
chooses a probability distribution for A such that no matter what pc(g) Eve chooses, some 
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secrecy rate R s is always guaranteed, and she tries to maximize this R s . Hence, the maxi-min 
criteria in (OQ) turns into: 

R*= max minR s (p G (.), A 1 ,A 2 ,p) (4) 

p,Ai,A 2 p G (.) 

Obviously, larger r = leads to more eavesdropper confusion. However, because -E[|^4| 2 ] = 1, 
r 3> 1 leads to a small A 2 , and Bob then suffers noise enhancement. We talk about the choice 
of r in the next paragraph. 

Recall the potential operating scenario from Section HI and assume that system radios are 
operating in a scenario where they have adequate power amplifier headroom, as in the "near" 
situation in cellular systems (271, an d the user's noise is relatively negligible. However, an Eve at 
the same range can also intercept the signal. By changing the power of the transmitters between 
the power-controlled level (e.g. A 2 ), where it meets the receiver requirements and its maximum 
power (e.g. A{), Bob, knowing the sequence, obtains a signal that is at least equivalent to 
operating at its power controlled level and thus sees little degradation in information transmission. 
The ratio between the large gain and the small gain, r, can be chosen such that in the case of 
A = A 2 (small gain), the minimum acceptable signal level at Bob's receiver is satisfied. On 
the other hand, Eve's A/D struggles even to record a reasonable form of the signal; hence, she 
sees significant degradation, and information-theoretic security is obtained. Also, because the 
power level is changed very fast (at every symbol), the automatic gain control (AGC) at the 
eavesdropper's receiver cannot follow the deep fades that cause erasures and/or strong signals 
that cause A/D saturation. 

To choose optimum values for A\, A 2 , and p, note that the following constraints must be met: 

4 1 = r and pA\ + (1 - p)A\ = 1 (5) 
A 2 

Hence, two of these values are constrained by the system parameter r and conservation of 
transmission power, and the transmitter is free to choose only one (e.g. p). So, equation © 
reduces to: 

R* s = max min R s (p G (.), p) (6) 
p pg(-) 

Eve can employ a number of countermeasures to decrease R s . She can find an optimum proba- 
bility density function that minimizes R s , or she can employ a better A/D to decrease erasures 
and/or overflows of her A/D. In the sequel, we will consider these scenarios and consider the 
secrecy rate R s that can be achieved by the method proposed in this paper in each case. 
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III. Achievable Secrecy Rates 

In this section the secrecy rates that can be achieved considering the non-idealities of the 
A/D's at the front-ends of Bob and Eve's receivers are studied. In the first part, the channel 
between Alice and Bob and the channel between Alice and Eve are considered to be AWGN 
channels. In the second part, to get more insight into the problem, the noise is removed from 
the channels and only the effect of A/D's on the signals will be considered. 

A. Noisy channels 

Consider the derivation of I(X; Y) — I(X; Z) = h{Y)-h{Y\X)-{h{Z)-h{Z\X)). Clearly, 
each of h(Y), h(Y\X), h(Z), and h(Z\X) are required. Recall that throughout this paper the 
non-idealities of the A/D's are modeled by an additive uniformly distributed quantization noise 
and a clipping function; hence, the signal Y after Bob's A/D with input Y is: 

Y + n q , \Y\ < a 
V = I +a, Y > a 

—a, Y < —a 

where Y = X + ^j- and a is determined by the span [—a, a] of the A/D. Thus, Y has a zero-mean 
Gaussian distribution with variance P + N B /A 2 , i.e. Y ~ Af(0, P + N B /A 2 ). Let's define the 
event E 1 = {\Y\ < a} which corresponds to the case that no clipping occurs, and the events 
E 2 = {Y > a} and E 3 = {Y < —a} to correspond to clipping (A/D overflow); thus, 

3 

h(Y) = J2Hy\E i )p(E t ) 

i=l 

In the case of clipping we have h(Y\E 2 ) = h(Y\E 3 ) = 0. The probability that the A/D is not 
in overflow is: 

p(E 1 ) = 1-2Q\ . a 
Then, h(Y\Ei) is calculated as: 

fYlEAy) = fy\ El (y) * fn q {y) = ^ J f Y ( S ) U l-S/2,5/2](y - S)ds = -J fy{s)d.S 

\N v ~ m ) t( V+S ' 2 11 lvl<« m 
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where U\s/2,s/2](-) ls the rectangle function on [—5/2,5/2], i.e. the value of the function is 1 
on the interval [—5/2,6/2] and is zero elsewhere. Thus, 

KY)= ^l-2Q^====^ ^ -f Y \ El {y)\og{f Y \ E M)dy (8) 
Similarly, for h(Y\X) we have, 



3 poo 3 

h(Y\X) = J2 h (Y\E l ,X)p(E l \X) = / ^2h(X\Ei,X = x)p(Ei\X 
i=i i=i 



x)f x {x)dx (9) 



where /i(F|E 2 ,X = x) = /i(F|E 3 ,X = x) = 0. The probability that Bob's A/D works in its 
dynamic range given X is, 

p(Ei\X = x)= p{\Y\ < a\X = x) 

= p(\x+ -j| < a) 

= p(— A(a + x) < riB < A(a — x)) 
= Q r-A(a + x)\_ Q fA(a-x) 



\ VNb J V VNb 
The signal before Eve's A/D Y given X = x has a Gaussian distribution with mean x and 

variance N B /A 2 within the interval \x + ^\ < a and zero elsewhere. In order to calculate 

h(Y\E\,X = x), fy\Ei,x=x(y) is required. Using the same reasoning as in © we have, 

I ry+s/2 

fY\E u X=x(y) = fylE^xiy) * fn q (y) = T / hlE^xWV 

Jy-8/2 

l( (y-S/2- X \ (y + S/2- x \\ 

S \ v \ sfW^J? ) v ^ v^W^ ))' 

Hence, 

h(Y\X) = J™ ^ -f YlEl ,x= x (y) log(f YlEuX=x (y))dy^ p{E x \X = x)f x (x)dx (10) 

By using h(Y) from ® and h(Y\X) from (flOl) . the mutual information between X and Y can 
be found: 

I{X-Y) = h{Y)-h{Y\X) (11) 
The signal that Eve after her A/D sees is, 

Z + n q , \Z\ < a 
+a, Z > a 

—a, Z < —a 
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where Z = ^f- + ^ and thus Z ~ A/"(0, A2p c p NE ). Similar to the previous case, the event 
that the signal before Eve's A/D falls in its dynamic range is E[ = {\Z\ < a}, and the events 
E' 2 = {Z > a} and E' 3 = {Z < —a} correspond to the cases that Eve's A/D overflows. 
Consequently, 

h(z) = j2h(m)p(Ei) 

8=1 

In the case that clipping occurs h(Z\E' 2 ) = h(Z\E' 3 ) = 0. The probability of no clipping at Eve's 
A/D is, 

/ ,x / Ga 

p(E[) = 1-2Q[ ; 

FK V ^ \y/A*P + N E , 

In order to calculate h(Z), the probability density function of Z given that the A/D does not 
overflow is required. Using the same reasoning as in ©: 



i r . , ,„ , , . 1 



fz\E[(z) = fz\E'( Z ) * fn q (z) = T / f Z 0) U[- S /2,S/2] - s)d S = - / /z( S )^ S 

fl J -a $ Jz-8/2 



z+8/2 



and thus, 



s \c\y/A>p+N E ) v w^p+ivw;' 11 

= (l-2Q ( v ^ Q +jVg )) £ a -fz\E>(z)log(f zlE[ (z)(z))dz (13) 

Similarly, 

/i(z|x) = ^/i(z| j e;;,xm j e; 1 / |x)= / = = x)f x (x)dx (14) 

i=i •^-° o i=i 

where h{Z\E' 2 ^X = x) = h(Z\E' 3 ,X = x) = 0. The probability that the signal before Eve's 
A/D is in the A/D's dynamic range given X is, 

p(E[\X = x)= p(\Z\ < a\X = x) 
..Ax n E , s 

= p(i-G+-a\<«) 



p(-(Ga + Ax) < n E < Ga - Ax)) 
. , -(Ga + Ax)\ fGa-Ax\ 
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In order to calculate h(Z\E[, X), fz\E[,x=x{ z ) ls required. Since Z = AX/G + ue/G, Z given 
X = x has a Gaussian distribution with mean Ax/G and variance N E /G 2 where \Ax/G + 
n E /G\ < a, 

I rZ+5/2 

fz\E[,X=x(z) = fz\E' 1; X=x( Z ) * fn g (z) = ^ f Z \X=x( Z ) ds 



z-<5/2 

$ V V Vn^ ) ^ V Vn e 

and, 

/i(Z|X) = (J a -fz\E>,x= x (z) log(f z \E[,x=*(z))dz\ p(E[\X = x)f x (x)dx (15) 

By substituting h(Z) from (TT3T) and h[Z\X) from (fT5T) in the following equation, 

J(X; Z) = - h(Z\X) (16) 

the mutual information between Alice and Eve can be found. 

The achievable secrecy rate can be found by substituting the mutual informations from (fTT|) 
and (fT6l) into the following equation: 

R s = E GA [/(X; Y) - I(X; Z)\ = E A [/(X; Y)\ - E GA [/(X; Z)\ (17) 

Alice is able to choose p to maximize the R s that can be achieved by this method; on the 
other side, Eve tries to minimize R s by choosing an appropriate Pg{-)- The following lemma 
shows that for an arbitrary discrete alphabet for G, choosing a single value (which depends on 
the value of p) with probability one minimizes the secrecy rate, and thus is the optimal strategy 
for Eve. 

Lemma 1. The gain l/G that Eve applies before her A/D should take a single value with 
probability one to minimize the secrecy rate. 



Proof: Suppose G has the following probability density function: 

Pg(q) = 



oti, g = Gi,i = 1, • • • ,n 
0, else 



such that Y^i=i a i = 1- Without loss of generality, assume that for a specific p, the maximum 
information leakage occurs at G = G\, i.e. for any gain G,, i = 2, • • • , n we have /(X; Z\G = 
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G?i) > I(X;Z\G = d); hence, 

n n 

i(X; z) = J2 a iH x ; Z \G = Gi) < a iH x ; Z \ G = G i) = H x ; z\G = d 



i=l i=l 



The above lemma can easily be generalized to continuous random variables. Numerical results 
are given in Sections [IV] and |V] 

B. Noiseless Channels 

In the case Bob has a noiseless channel, h(Y) can be found by setting Nb = in ©. To 
calculate h(Y\X), using © and the fact that h(Y\E 2 ,X = x) = h(Y\E 3 ,X = x) = we have, 

/oo 
/i(Y|£ 1 ,X = x)p(£i|X = x)/ x (x)cfc (18) 
-oo 

/oo 
+ n q \X = x)p(E 1 \X = x)f x {x)dx 
-oo 

h(n q )f x {x)dx 



\og{5) [ 1 - 2Q ( ^= ) ) (19) 



Similarly, in the case that the channel between Alice and Eve is noiseless, h(Z) can be found 
by setting N E = in ((T3l To calculate /i(F|X), using (Q3]) and the fact that h(Z\E' 2 , X = x) = 
h(Z\E' 3 ,X = x) = we have, 

/oo 
h{Z\E' 1 ,X = x)p(E' 1 \X = x)f x (x)dx 
-oo 

/°° AX 
h{-— + n q \E[,X = x)p(E[\X = x)f x {x)dx 
oo ^ 
rGo/|A| 

= / h(n q )f x (x)dx 

J-Ga/\A\ 

= log W (l-2 (-^)) (20) 

In each case, the secrecy rate can be found by substituting (fT9l and (|20l) in ([111) and (TT6l) , 
respectively. Numerical results are shown in Sections [IV] and |Vl 

Clearly, considering the noiseless channels makes the results less complicated and hence 
more insightful. Hence, we continue our investigation by studying the asymptotic behavior of 
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Fig. 3. Achievable secrecy rate versus r (the ratio between the large and the small gain) when both the main and eavesdropper's 
channels are noiseless and both Bob and Eve apply 10-bit A/D's with the dynamic range a = 2.5. 



the proposed method (as r — > oo) in the noiseless regime, which will help us to achieve some 
intuition regarding this scheme. We assume that Bob and Eve use A/D's of the same quality for 
this analysis. 

Since in the noiseless regime, I(X; Y) does not depend on A, it does not change with r and 
thus we just evaluate I(X; Z) for our asymptotic analysis. 
From © we have, 

r 1 
A\ = —^^^=^^^= and A 2 = -^^^==^^^= 

^Jpr 2 + (1 — p) ypr 2 + (1 — p) 

Let G(r) be the inverse of the gain that Eve employs as a function of r. Recall that from Lemma 
1, G(r) will take a single value with probability one for a given r, but that value can depend 
on r. Since Ai — >■ 1/y/p and A 2 — > 0, we claim that in the limit (as r — > oo), the best strategy 
that Eve can take is to choose either G(r) = 0(1) or G(r) = 6(r _1 ); otherwise, she will get 
no information (see Appendix A). 

First we study the secrecy rates that can be achieved when G(r) = 0(1) as r approaches oo. 
The average secrecy rate is: 

R S = E[I(X;Y)-I(X;Z)} 

= p(I(X; Y\A = A,) - I(X; Z\A = A t )) + (1 - p)(I(X; Y\A = A 2 ) - I(X; Z\A = A 2 )) 

(21) 
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p(B) = E 




Fig. 4. Gaussian erasure wiretap channel: in the asymptotic case, the erasures/overflows at Eve's A/D due to the rapid power 
modulation at the transmitter can be modeled by an erasure channel. 



Assuming that Bob Chooses the optimum range for her A/D, the maximum I(X; Z\A = A\) 
that Eve can achieve is I(X; Y\A = Ai) and hence the first term in (1211) is zero. To evaluate 
the second term, putting G(r) and A = A 2 in (fT3l) and (|20l) yields: 

HZ) ={l-2Q (f^=)) £ -/W*)M/W*X*))^ C 22 ) 
where since G(r) = 0(1), 

, ^ 1 fr>f G ( r )( z - 5 / 2 )\ ^G(r)(z + 5/2)\\ , 

|, < |z| < 5/2 

"M B, l*l = */2 
0, otherwise 

and ^1 — 2Q ( ;f~7§ J J ~~ ^ as r ~~ ^ 00 ' ^ mce me integrand in (|22l) is bounded for all r, from 
the dominated convergence theorem, h(Z) — > log 5 as r — > oo. Also since G(r) = 0(1), 

h(Z\X) = \og(5) (l - 2Q ) -> log(5) (23) 

as r approaches oo. Thus, /(X; Z\A = A 2 ) = and hence the average secrecy rate given that 
G(r) = 9(l) is fl a = (l-p)J(X;y). 

Now suppose G = 6(r _1 ) and consider the second term in (TfTT) . In the limit, = c where 
c > is a bounded constant. Since Bob chooses the optimum range for his A/D, the maximum 
I(X; Z\A = A 2 ) that Eve can achieve is I(X; Y\A = A 2 ) and thus given that G(r) = 0(r _1 ), 
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the second term in (|2TT) is zero. To evaluate the first term in (|2TT) as r gets large, by substituting 

G(r) = 6(r- 1 ) and A = A 1 in ^ and & we have f z]E > (z) and, 

as r approaches infinity and hence h(Z) — >■ 0. Also by letting G(r) = 0(r x ) we have, 
/i(Z|X) = log(tf) - 2Q (^jj=J J as r -> oo 

Hence, with the probability p the mutual information between Alice and Eve is zero and the 
average secrecy rate that can be achieved given G(r) = 6(r _1 ) as r approaches oo is R s = 
pI(X;Y). 

We can interpret these results as follows; when A/G(r) = A 1 /Q(r~ 1 ), the total gain that 
Eve's A/D sees approaches infinity as r — > oo; hence, even if Eve uses an A/D with larger range 
than Bob's A/D, her quantizer overflows. When A/G(r) = A 2 /0(1), the total gain goes to zero 
as r approaches infinity and thus even if Eve uses an A/D with better precision, the received 
signal amplitude is less than one quantization level. In both cases, the eavesdropper receives no 
information about the transmitted signal and thus the eavesdropper's channel can be modeled by 
an erasure channel (Figure HJ), where for G(r) = 0(r _1 ), the probability of erasure e = 1 — p 
and for G(r) = 6(1), e = p. 

Hence, the secrecy rate that can be achieved in the asymptotic case (as r — > oo) is: 

R s = (l-e)I(X;Y) (24) 

To maximize the achievable secrecy rate, it is reasonable for Alice to choose p = 0.5. In 
Section lIV-AI it is shown that for a 10-bit A/D and the transmitter power P — 1, the optimum 
span of the A/D is a = 2.5, and the corresponding mutual information between Alice and 
Bob (when the channel between them is noiseless) is I(X; Y) = 6.597. Hence, using ([24]) 
R s 0.5 x 6.597 = 3.2985. Figure [3] shows the achievable secrecy rate versus r when both 
main and eavesdropper's channels are noiseless. It can be seen that as r gets larger, the achievable 
secrecy rate goes to a constant which is similar to what anticipated. Furthermore, for larger r's 
(r > 10 3 ) the actual optimum probability that maximizes the worst case secrecy rate is p = 0.5. 
These show that in the limit, our results are consistent to expectations. 

From another point of view, for small values of 5, the quantization noise can be modeled by 
a zero mean Gaussian random variable with the variance <5 2 /12, where 5 is the size of each 



19 



quantization level. Thus, this wiretap channel can be modeled by a Gaussian erasure wiretap 
channel. 

The secrecy capacity of the Gaussian wiretap channel is [|28l : 

C s = i (log(l + \h B \ 2 lB ) - log(l + \h E \ 2 lE )) + 

where h B and h E are channel gains, ^ B is the SNR at Bob's receiver and 7^ is the SNR at Eve's 
receiver. We can use this secrecy capacity in our asymptotic model, by setting h B = 1, and by 
modeling the erasure channel by a strange fading channel with the following fading distribution: 

I ' W -P- e 

h E = < 

I 1 , w.p. 1 — e 

Since we assumed that Eve's A/D is identical to Bob's A/D, ^ E = ^ B = jzj^ and thus the 
secrecy capacity is non-zero only when an erasure at the eavesdropper's channel occurs. Hence, 

C s = ^-^-\ og (l+ lB ) (25) 

This equation shows that for a 10-bit A/D with a = 2.5, transmitting power P = 1, and 
e = p = 0.5, the secrecy capacity is C s = 3.2822 which is again very close to what we expected 
from our asymptotic analysis. Furthermore, on comparing equations (l24l) and (1251) . it is seen that 
in the asymptotic case, the achievable secrecy rate meets the secrecy capacity. 

IV. Numerical Results 
A. Noiseless Channels: Eve with the same A/D as Bob 

In this section, we begin our investigation by considering only the effect of A/D's on the 
signals. Hence, we assume that the eavesdropper's channel is noiseless, i.e. n B = (which 
benefits the eavesdropper). However, we also assume the system nodes are working in a very 
high SNR regime and thus the channel noise at Bob can be neglected (n B — 0). 

Now suppose that both Bob and Eve use 10-bit quantizers (b = 2 10 ) and the transmitter power 
is P = 1. Since S = 2a/b, for a fixed number of quantization bits, I(X; Y) is a function of the 
span of the A/D (a), and the optimal quantization range that maximizes I(X; Y) can be found. 
Since I(X; Y) is an intricate function in terms of a, we find the optimum a numerically. In this 
case, the optimum quantization range that maximizes I(X; Y) is a = 2.5, and the corresponding 
mutual information between Alice and Bob is I(X; Y) = 6.597. From now on, we use a = 2.5 
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Fig. 5. Achievable secure rate vs. the probability p and the gain G at Eve's receiver. Both Bob's and Eve's channels are 
noiseless and they use identical 10-bit A/D's. The ratio between the two power levels at the transmitter is r = 10 3 (i.e. 30 dB) 
and the average transmitting power is P = 1. A maxi-min rate of R s = 3.1372 is achieved. 



in our calculations. Suppose that Eve has the same A/D as Bob. From the lemma above, putting 
a random gain is undesirable for Eve; hence, she chooses a fixed gain G that minimizes R s . 
Because Alice is not aware of Eve's choice, she has to choose a probability p that maximizes 
the worst case R s . The plot of R s versus p and G for P = 1 and r = 10 3 (i.e 30 dB)where 
both Bob and Eve are using 10-bit A/D's is shown in Figure [5] This function is complicated 
and hence the optimum value of p cannot be derived analytically. Numerical analysis shows that 
p « 0.5 maximizes the worst case R s , and the maxi-min value is R s = 3.1372. Hence, choosing 
p = 0.5 guarantees that at least the secrecy rate R s = 3.1372 can be achieved. 

B. Noiseless Channels: Eve with a Better A/D than Bob 

Now suppose that Eve has access to a better A/D than Bob. Depending on the gain that Eve 
applies before her A/D, a better A/D results in less erasures and/or less A/D overflows. Hence, the 
mutual information between Alice and Eve increases and consequently, the achievable secrecy 
rate decreases. Figure [6] shows the effect of using a better A/D on the achievable secrecy rate 
versus p and G. It can be seen that even if Eve uses an A/D which is 24 dB (4 bits) better 
than Bob's A/D (Eve has a 14-bit A/D while Bob has a 10-bit A/D), by choosing an appropriate 
value for p, a positive secure rate can be achieved. In this example, by choosing p = 0.4, a 
secure rate R s = 1.2478 is achievable. Even if we do not change the probability p from the 
previous section (p = 0.5), assuming that Alice is not aware of Eve's better A/D, a secure rate 
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Fig. 6. Achievable secure rate vs. the probability p and the gain at Eve's receiver, G for the case of noiseless channels. The 
ratio between the two power levels at the transmitter is r = 10 3 (i.e. 30 dB) and the average transmitting power is P = 1. In 
the upper curve, both Bob and Eve have the same 10-bit A/D's. In the lower curve, Bob uses a 10-bit A/D while Eve uses a 
14-bit A/D (Eve's A/D is 24 dB better than Bob's A/D) and a maxi-min rate of R s = 1.2478 is achieved (for p = 0.4). 

R s = 0.6023 is achievable. In spite of having a better A/D, Eve will still lose some symbols 
and hence a positive secrecy rate is available. This is because the ratio between the large and 
the small gain, A\ and A 2 , is 10 3 , while Eve's A/D has only 16 times better resolution; thus, 
she still needs to compromise between resolution and overflow. To cancel the effect of these 
gains completely, Eve has to use an A/D that has an effective resolution after taking into account 
jamming, interference, etc. on the order of 10 3 times (10 bits) better than Bob's A/D, which 
would be very difficult in an adversarial environment. 

C. Noisy Main Channel, Noiseless Eavesdropper's channel 

Now we look at the extreme case that Eve is able to receive exactly what Alice transmits and 
receives (e.g. the adversary is able to pick up the transmitter's radio and hook directly to the 
antenna), but the channel between Alice and Bob is noisy and hence no other technique works. 
In other words, the channel between Alice and Bob experiences an additive white Gaussian noise 
(n B ~ A/"(0, N B )), while Eve's channel is noiseless (n E = 0). Figure [7] shows the secrecy rate 
R s that can be achieved using the proposed scheme versus the signal to noise ratio (SNR) at 
Bob's receiver. In this case, the transmitted power P = 1 and the ratio between the large and the 
small gain is 30 dB. Both Bob and Eve use 10-bit A/D's and Alice sets p = 0.5. It can be seen 
that, although the eavesdropper's channel is much better than the main channel, when the SNR 
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SNR B (dB) 

Fig. 7. Achievable secure rate vs. SNR at Bob's receiver while the SNR at Eve's receiver is infinity (Eve has perfect access 
to the transmitted signal) for r = 10 s , P — 1 and Bob and Eve applying 10-bit A/D's. Note that the assumption of Eve having 
a noiseless channel is the extreme case when the eavesdropper has perfect access to the transmitter's output (for instance, the 
eavesdropper is able to pick up the transmitter's radio) and hence other secrecy methods are not applicable. Using the proposed 
method, a positive secrecy rate can be achieved over short range at reasonable power. 
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Fig. 8. Public discussion vs. the proposed method: Achievable secure rates when the SNR at Bob's receiver is 60 dB and the 
SNR at Eve's receiver changes from 40 dB to 80 dB. The settings have r = 10 3 , P = 1, and both Bob and Eve applying 10-bit 
A/D's. Note that when Eve's channel is better than Bob's (i.e. the case of most interest), the proposed method outperforms 
(often significantly) the public discussion approach. 



at Bob's receiver is greater than 60 dB, which is quite common in short-range communication, 
a positive secrecy rate is available. 
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Fig. 9. Public discussion vs. the proposed method: Achievable secure rates when the SNR at Bob's receiver is 80 dB and the 
SNR at Eve's receiver changes from 60 dB to 100 dB. the settings are r = 10 3 , P = 1, and Bob and Eve applying 10-bit 
A/D's. 



When the channel between Alice and Eve is less noisy than the channel between Alice and 
Bob, the secrecy capacity of the conventional wiretap channel is zero. However, by using public 
discussion strategies, a positive secrecy rate is achievable. Public discussion, in contrast to 
the wiretap channel which is limited to one-way and rate-limited communication, may take 
advantage of two-way communication over a noiseless and public authenticated channel. Hence, 
the legitimate parties can agree on a secret key by extracting information from realizations 
of correlated random variables. This secret key will be used in a one-time-pad for secret 
communication between Alice and Bob. A closed form for the general secret-key capacity is 
not available; however, in the case of a Gaussian source model in which X ~ A^(0, P) and a 
Gaussian wiretap channel, i.e. when the channel between Alice and Bob and the channel between 
Alice and Eve are AWGN channels, the secrecy capacity has a simple form E4l Chapter 5]: 



and thus all secret-key rates below Cf M are achievable. 

Here, we compare the secrecy rates that can be achieved by public discussion and our proposed 
scheme. Note that in the case that Eve has perfect access to the transmitted signal, i.e. Eve 
receives exactly what Alice transmits, using public discussion the secrecy capacity is always 



V. Comparison to Other Methods 




(26) 
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zero, while the proposed scheme can achieve positive secrecy rates (Section IIV-CI) . Achievable 
secrecy rates for the case that Eve also receives a noisy version of the transmitted signal when 
SNR at Bob's receiver is 60 dB and 80 dB are shown in Figures [8] and |9l respectively. In both 
cases, when the eavesdropper's channel is better than the main channel (which is our main 
interest), the proposed method is superior to public discussion. Furthermore, when system nodes 
work in a high SNR regime (e.g. SNR B =80 dB), the secrecy rates that can be achieved by the 
proposed method are greater than the secrecy rates that can be achieved by public discussion. 

VI. Conclusion 

In this paper, we introduce a new approach that exploits a short-term cryptographic key to 
force different orderings at Bob and Eve of two operators, one of which is necessarily non-linear, 
to obtain the desired advantage for information-theoretic security in a wireless communication 
system regardless of the location of Eve. We then investigate a simple power modulation 
instantiation of the approach. It is shown that when Eve's channel condition is better than the 
main channel, the secrecy rates that can be achieved using our proposed method are substantially 
higher than other methods designed to work in situations with an advantaged eavesdropper (such 
as public discussion). In particular, it is shown that in contrast to public discussion, even in the 
case that the adversary is able to pick up the transmitter's radio (i.e. Eve has perfect access to the 
output of the transmitter), a positive secrecy rate is achievable at high SNRs which might apply 
to a short-range wireless system. For example, one might use the transmission power of typical 
cellular systems with the corresponding excess power at short ranges to establish a secure radio 
system in a limited area. 

Although we have considered the case of Eve with a better A/D than Bob, the clear risk to the 
approach is still that of asymmetric capabilities at the receivers. For example, if we employ the 
simple power modulation approach studied extensively here, Eve may employ multiple A/D's 
with different gain settings in front of each. Hence, Eve would be able to record two signals 
independently and decode them later when she gets the key or extracts the key based on the 
pattern of erasures and overflows at each A/D. A simple approach to combat this problem is, 
rather than applying a gain A with a discrete pdf at the transmitter, the transmitter can apply a 
gain with a continuous pdf. More promising, however, is to consider drawing the signal warping 
from a class of nonlinearities and adding memory to the signal warping process. 
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Broadly considering potential techniques for everlasting security in wireless systems, including 
that proposed here, yields that each approach still holds some risk. In the case of cryptographic 
security, assumptions must be made on both the hardness of the problem and the current/future 
computational capabilities of the adversary. In the case of information-theoretic security, assump- 
tions must be made on the quality of the channel to Eve, generally corresponding to limitations 
on her location. In the method proposed here, assumptions must be made on Eve's current 
conversion hardware capabilities, but, as in information-theoretic secrecy, there is no assumption 
on future capabilities. All three approaches thus have different applicability. 

Appendix A 

Instead of applying G(r) = 6(1) or G(r) = 6(r~ 1 ), the two other possibilities for Eve are to 
choose G(r) such that either lim^oo r~ l /G(r) — > or lim^^ r~ l /G(r) — » oo (and obviously 
provided that G(r) ^ 6(1)). 

First suppose lim^oo r _1 /G(r) — > and consider I(X;Z\A = A\) in (|2T|) . Since G(r) ^ 
6(1), lim^oo A\/G(r) — > and hence, 

h{Z) ={l-2Q (f^=)) f_-f Z \ E[ {z)\og{f z \ E[ {z){z))dz (27) 

where, 

1 („( G(r)(z-5/2) \ „{ G(r)(z + 6/2) \\ 

fz ^ {z) = 5 [ Q { Al VP ) ~ Q { AVP )) ' N < a 

h 0<\z\< 5/2 
0, otherwise 

and ^1 — 2Q j — >• 1 as r — >• oo. Since the integrand in (|27l) is bounded for all r and from 

the dominated convergence theorem, h(Z) — > log 5 as r — > oo. Also, since lim^oo r~ 1 /G(r) — > 
0, 

h(Z\X) = \og(6) (l - 2Q (f^§)) logW 

as r approaches oo and thus /(X; Z\A = A\) = 0. Now consider I(X; Z\A = A 2 ) in (|2T|) : 
by substituting A\ with A 2 in the above equations, since \\m. r ^ 00 r~ 1 jG{r) — » and hence 
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A/G(r) = A 2 /G(r) — > as r — >■ oo, we have /(X; Z|A = A 2 ) = 0. Consequently, given that 
hm r _ > . 00 r~ l /G(r) — > 0, the average information that the eavesdropper obtains is zero. 

Now suppose Eve chooses G(r) such that lim^oo r _1 /G(r) — > oo and consider the first term 
I(X;Z\A = Ax) in (|2TI) . The fact that Hindoo r _1 /C7(r) — > oo implies that in the limit as 
r — > oo, Ax/G(r) also goes to oo and thus from (fT3l) and (T20l) we have (2) — ► 0. Also, 

as r approaches infinity and hence h(Z) — >■ 0. Furthermore, 

= log(<J) U - 2Q (^7=)) ^ as r ^°° 

and thus I(X; Z\A = Ax) = 0. Considering I(X; Z\A = A 2 ) in d2B and by putting A 2 instead 
of Ax in the above equations, since again A/G(r) = A 2 /G{r) — > oo as r — > oo, we have 
I(X;Z\A = A 2 ) = 0. Hence, by choosing lim^oo r~ l /G(r) — > oo the eavesdropper gets no 
information about the transmitted signal. 
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